The Information Commissioner’s Office (ICO) has fined ride sharing
company Uber £385,000 for failing to protect customers’ personal
information during a cyber attack.

A series of avoidable data security flaws allowed the personal details
of around 2.7million UK customers to be accessed and downloaded by
attackers from a cloud-based storage system operated by Uber’s US parent
company. This included full names, email addresses and phone numbers.

The records of almost 82,000 drivers based in the UK – which included
details of journeys made and how much they were paid – were also taken
during the incident in October and November 2016.

The ICO investigation found ‘credential stuffing’, a process by which
compromised username and password pairs are injected into websites until
they are matched to an existing account, was used to gain access to
Uber’s data storage.

However, the customers and drivers affected were not told about the
incident for more than a year. Instead, Uber paid the attackers
responsible $100,000 to destroy the data they had downloaded.

ICO Director of Investigations Steve Eckersley said: “This was not only
a serious failure of data security on Uber’s part, but a complete
disregard for the customers and drivers whose personal information was
stolen. At the time, no steps were taken to inform anyone affected by
the breach, or to offer help and support. That left them vulnerable.”

The
incident, a serious breach of principle seven of the Data Protection Act
1998, had the potential to expose the customers and drivers affected to
increased risk of fraud. It came to light when an announcement, made by
the company itself, was reported by the media in November 2017.

Mr Eckersley added: “Paying the attackers and then keeping quiet about
it afterwards was not, in our view, an appropriate response to the cyber
attack.

“Although there was no legal duty to report data breaches under the old
legislation, Uber’s poor data protection practices and subsequent
decisions and conduct were likely to have compounded the distress of
those affected.”

The data protection authority for the Netherlands, the Autoriteit
Persoonsgegevens, has also issued a fine to Uber today under its own
pre-GDPR legislation. The Dutch regulator was the lead member of an
international task force which included the ICO and which co-operated in
investigating the effects of the incident in their respective
jurisdictions.